ledger-live-login-ckx[.]pages[.]dev

This domain, ledger-live-login-ckx.pages.dev, is actively engaged in brand impersonation targeting Ledger, a cryptocurrency wallet provider. The site presents itself as a legitimate Ledger Live Wallet interface for secure crypto and NFT management, aiming to deceive users into disclosing sensitive credentials or authorizing malicious transactions. As of the latest analysis, the domain remains operational and poses a high risk to unsuspecting visitors. Infrastructure analysis reveals the domain was registered on September 09, 2025, through Cloudflare, Inc. It resolves to the IP address 172.66.44.103, which is hosted on Cloudflare's network (AS13335) and geolocated in the United States. The SSL certificate is issued by Google Trust Services under the identifier WE1. Detection metrics indicate the domain is flagged by 7 of 95 security vendors on VirusTotal and appears on one security blocklist. The page title, 'Ledger Live Wallet – Secure Crypto & NFT Management,' directly mimics official Ledger branding to enhance credibility. Current status confirms the domain remains active, continuing to host the fraudulent Ledger impersonation page. Users are strongly advised to avoid interaction with this domain and verify the authenticity of any Ledger-related communications through official channels. Organizations should update their web filtering rules to block access to ledger-live-login-ckx.pages.dev and monitor for similar impersonation attempts targeting cryptocurrency platforms. Security teams are encouraged to correlate this indicator with existing threat intelligence to identify potential related infrastructure.